CVE-2024-26779

What it actually does

Race condition allows fast-xmit to be enabled before a station is fully uploaded to the driver, resulting in drv_tx calls passing a not-yet-uploaded sta with uninitialized drv_priv data and potential kernel crashes.

Why it matters to the business

Wireless networking instability on Linux systems can lead to crashes or degraded connectivity, increasing operational downtime and requiring emergency kernel updates across fleets of servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access or the ability to influence station association timing triggers the race window between station creation and driver upload, causing the kernel to invoke driver transmit paths on incompletely initialized station structures.

How to fix it

Update the Linux kernel to the commit 76fad1174a0cae6fc857b9f88b261a2e4f07d587 or later stable releases that include the added sta->uploaded check and re-check after station insertion.

How to confirm the fix worked

Confirm the presence of the sta->uploaded guard and the post-insertion fast-xmit re-evaluation in the mac80211 station upload path; test station association under concurrent fast-xmit enablement scenarios.

Typical attack path

1. Create or associate a wireless station via mac80211
2. Race the sta->uploaded flag check during fast-xmit enablement
3. Invoke drv_tx before driver private data is initialized
4. Trigger kernel crash or undefined behavior from uninitialized memory access

How to detect it

Review kernel logs for crashes or warnings referencing mac80211 station upload and fast-xmit paths around the time of wireless association events.

What your security team should do

• Prioritize kernel upgrades to the fixed commit on all systems using mac80211 wireless drivers
• Monitor for wireless-related kernel oops or crashes after station events
• Apply the update before enabling fast-xmit features in production wireless configurations